Nautilus/ledgerdock
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update report

Browse Source
This commit is contained in:
Beda Schmid
2026-03-01 18:15:14 -03:00
parent aba320b617
commit 9cbbd80f47
1 changed files with 0 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
REPORT.md
View File

@@ -44,14 +44,6 @@ Reason: one blocking, code-level security issue was found.
## Additional Code-Level Findings (Non-blocking)
### Medium: Non-deterministic frontend dependency versioning
- Severity: Medium
- Risk: `lucide-react` is set to `latest`, making builds time-dependent and increasing supply-chain unpredictability.
- Evidence:
- `frontend/package.json:13`
- Recommendation:
- pin an explicit semver version and update intentionally via dependency review workflow
### Low: One security middleware regression test is currently not executable
- Severity: Low
- Risk: reduced confidence in continued enforcement of upload middleware behavior.